program: r0 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f0000000b00)={0x0}) r2 = syz_open_dev$dri(&(0x7f0000000b40), 0x1, 0x82702) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./sys\x00', &(0x7f0000001080)='sysfs\x00', 0x1000, 0x0) syz_usb_connect(0x5, 0x2d, 0x0, 0x0) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, 0x0) r3 = openat$kvm(0xffffff9c, &(0x7f00000010c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000001100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = openat(0xffffffffffffff9c, &(0x7f0000001140)='./sys/kernel/mm/lru_gen/enabled\x00', 0x1, 0x0) write(r5, &(0x7f0000001180)='n', 0x1) r6 = openat(0xffffffffffffff9c, &(0x7f00000011c0)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x0) write(r6, &(0x7f0000001200)="b8", 0x1) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000b80)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r2, 0xc00864bf, &(0x7f0000000bc0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r2, 0xc02064cc, &(0x7f0000000c00)={r7, r8, 0x7, 0x7, 0x2}) r9 = syz_open_dev$dri(&(0x7f0000000c40), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r9, 0xc00864bf, &(0x7f0000000c80)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_FD(r9, 0xc01864c1, &(0x7f0000000cc0)={r10}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01864c2, &(0x7f0000000d40)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01864c2, &(0x7f0000000d80)={0x0}) r13 = syz_open_dev$dri(&(0x7f0000000dc0), 0x1, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r13, 0xc00864bf, &(0x7f0000000e00)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(r13, 0xc01864cd, &(0x7f0000000e40)={&(0x7f0000000e80)=[r14], 0x0, 0x1}) ioctl$BTRFS_IOC_DEFRAG_RANGE(r9, 0x40309410, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r13, 0xc03064ca, &(0x7f0000000ec0)={&(0x7f0000000f00)=[r14], 0x0, 0xe46, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc03064ca, &(0x7f0000000fc0)={&(0x7f0000000f40)=[r14, r8, r10, 0x0, r11, r14, r12, r1], &(0x7f0000000f80)=[0xfffffffffffffffc, 0x9, 0xfffffffffffffffe, 0x7fff, 0x8000000000000001, 0x5, 0x8], 0x100000001, 0x40000132, 0x6}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000080)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000180)={0x0, 0x0, r15}) [ 103.968236][ T4668] Bluetooth: hci0: command tx timeout [ 104.375766][ T5353] ------------[ cut here ]------------ [ 104.375778][ T5353] 1 [ 104.375782][ T5353] WARNING: mm/slub.c:5459 at ___kmalloc_large_node+0x10c/0x170, CPU#0: syz.0.0/5353 [ 104.382882][ T5353] Modules linked in: [ 104.385491][ T5353] CPU: 0 UID: 0 PID: 5353 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.389135][ T5353] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.392821][ T5353] RIP: 0010:___kmalloc_large_node+0x10c/0x170 [ 104.395043][ T5353] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 7c cb 0b 00 c6 05 68 5b 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 89 ef 89 [ 104.402702][ T5353] RSP: 0018:ffffc9000e347a00 EFLAGS: 00010246 [ 104.405113][ T5353] RAX: 0000000000000000 RBX: 00000001000004c8 RCX: 0000000000100000 [ 104.408846][ T5353] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000001000004c8 [ 104.412542][ T5353] RBP: 0000000000000cc0 R08: ffffffff85a4fcd9 R09: 0000000000000000 [ 104.416135][ T5353] R10: dffffc0000000000 R11: ffffffff85ae18b0 R12: 1ffff92001c68fb9 [ 104.419594][ T5353] R13: ffffffff85ae149a R14: 00000001000004c8 R15: 00000001000004c8 [ 104.422903][ T5353] FS: 00007f0c81d4b6c0(0000) GS:ffff88808a9fe000(0000) knlGS:0000000000000000 [ 104.426570][ T5353] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.429442][ T5353] CR2: 00007f0c80ee5bd0 CR3: 0000000013526000 CR4: 0000000000352ef0 [ 104.432859][ T5353] Call Trace: [ 104.434221][ T5353] [ 104.435548][ T5353] __kmalloc_large_node_noprof+0x18/0x90 [ 104.437981][ T5353] __kmalloc_noprof+0x3f6/0x710 [ 104.440042][ T5353] ? drm_syncobj_array_find+0x3a/0x440 [ 104.442259][ T5353] drm_syncobj_array_find+0x3a/0x440 [ 104.444541][ T5353] drm_syncobj_timeline_wait_ioctl+0x18a/0x640 [ 104.447133][ T5353] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 104.450046][ T5353] drm_ioctl_kernel+0x2df/0x3b0 [ 104.452110][ T5353] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 104.454882][ T5353] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 104.457065][ T5353] ? __might_fault+0xaf/0x130 [ 104.459289][ T5353] drm_ioctl+0x70e/0xba0 [ 104.461124][ T5353] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 104.463994][ T5353] ? __pfx_drm_ioctl+0x10/0x10 [ 104.466044][ T5353] ? __fget_files+0x2a/0x420 [ 104.468195][ T5353] ? bpf_lsm_file_ioctl+0x9/0x20 [ 104.470285][ T5353] ? __pfx_drm_ioctl+0x10/0x10 [ 104.472415][ T5353] __se_sys_ioctl+0xfc/0x170 [ 104.474523][ T5353] do_syscall_64+0x166/0x520 [ 104.476914][ T5353] ? trace_irq_disable+0x3b/0x140 [ 104.479225][ T5353] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.481843][ T5353] ? clear_bhb_loop+0x70/0xc0 [ 104.483805][ T5353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.486237][ T5353] RIP: 0033:0x7f0c80d9fb19 [ 104.488745][ T5353] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.496452][ T5353] RSP: 002b:00007f0c81d4afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 104.500496][ T5353] RAX: ffffffffffffffda RBX: 00007f0c81025fa0 RCX: 00007f0c80d9fb19 [ 104.504511][ T5353] RDX: 0000200000000fc0 RSI: 00000000c03064ca RDI: 0000000000000003 [ 104.508118][ T5353] RBP: 00007f0c80e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 104.511468][ T5353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.515222][ T5353] R13: 00007f0c81026038 R14: 00007f0c81025fa0 R15: 00007ffed9fa3458 [ 104.518754][ T5353] [ 104.520163][ T5353] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 104.523265][ T5353] CPU: 0 UID: 0 PID: 5353 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 104.526994][ T5353] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 104.531252][ T5353] Call Trace: [ 104.532682][ T5353] [ 104.533957][ T5353] vpanic+0x26f/0x710 [ 104.535661][ T5353] panic+0xc5/0xd0 [ 104.537237][ T5353] ? __pfx_panic+0x10/0x10 [ 104.539116][ T5353] __warn+0x315/0x4c0 [ 104.540796][ T5353] ? ___kmalloc_large_node+0x10c/0x170 [ 104.543124][ T5353] ? ___kmalloc_large_node+0x10c/0x170 [ 104.545464][ T5353] __report_bug+0x276/0x570 [ 104.547309][ T5353] ? ___kmalloc_large_node+0x10c/0x170 [ 104.549591][ T5353] ? __pfx___report_bug+0x10/0x10 [ 104.551804][ T5353] ? clockevents_program_event+0x491/0x630 [ 104.554288][ T5353] ? __pfx_clockevents_program_event+0x10/0x10 [ 104.556985][ T5353] ? ___kmalloc_large_node+0x10c/0x170 [ 104.559392][ T5353] report_bug+0x16b/0x220 [ 104.561261][ T5353] ? ___kmalloc_large_node+0x10c/0x170 [ 104.563625][ T5353] ? ___kmalloc_large_node+0x10e/0x170 [ 104.565940][ T5353] handle_bug+0x9c/0x200 [ 104.567748][ T5353] exc_invalid_op+0x1a/0x50 [ 104.572569][ T5353] asm_exc_invalid_op+0x1a/0x20 [ 104.574705][ T5353] RIP: 0010:___kmalloc_large_node+0x10c/0x170 [ 104.577217][ T5353] Code: 41 c7 46 30 00 00 00 f8 eb 03 45 31 ff 4c 89 ff 48 89 de 89 ea 5b 41 5c 41 5e 41 5f 5d e9 7c cb 0b 00 c6 05 68 5b 71 0f 01 90 <0f> 0b 90 31 c0 5b 41 5c 41 5e 41 5f 5d c3 cc cc cc cc cc 89 ef 89 [ 104.585523][ T5353] RSP: 0018:ffffc9000e347a00 EFLAGS: 00010246 [ 104.588284][ T5353] RAX: 0000000000000000 RBX: 00000001000004c8 RCX: 0000000000100000 [ 104.591466][ T5353] RDX: 00000000ffffffff RSI: 0000000000000cc0 RDI: 00000001000004c8 [ 104.594863][ T5353] RBP: 0000000000000cc0 R08: ffffffff85a4fcd9 R09: 0000000000000000 [ 104.598252][ T5353] R10: dffffc0000000000 R11: ffffffff85ae18b0 R12: 1ffff92001c68fb9 [ 104.601303][ T5353] R13: ffffffff85ae149a R14: 00000001000004c8 R15: 00000001000004c8 [ 104.604599][ T5353] ? drm_syncobj_array_find+0x3a/0x440 [ 104.606949][ T5353] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 104.609833][ T5353] ? drm_dev_enter+0x49/0x150 [ 104.611777][ T5353] __kmalloc_large_node_noprof+0x18/0x90 [ 104.614127][ T5353] __kmalloc_noprof+0x3f6/0x710 [ 104.616216][ T5353] ? drm_syncobj_array_find+0x3a/0x440 [ 104.618663][ T5353] drm_syncobj_array_find+0x3a/0x440 [ 104.620954][ T5353] drm_syncobj_timeline_wait_ioctl+0x18a/0x640 [ 104.623552][ T5353] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 104.626417][ T5353] drm_ioctl_kernel+0x2df/0x3b0 [ 104.628556][ T5353] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 104.631384][ T5353] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 104.633669][ T5353] ? __might_fault+0xaf/0x130 [ 104.635609][ T5353] drm_ioctl+0x70e/0xba0 [ 104.637404][ T5353] ? __pfx_drm_syncobj_timeline_wait_ioctl+0x10/0x10 [ 104.640174][ T5353] ? __pfx_drm_ioctl+0x10/0x10 [ 104.642160][ T5353] ? __fget_files+0x2a/0x420 [ 104.644151][ T5353] ? bpf_lsm_file_ioctl+0x9/0x20 [ 104.646338][ T5353] ? __pfx_drm_ioctl+0x10/0x10 [ 104.648432][ T5353] __se_sys_ioctl+0xfc/0x170 [ 104.650521][ T5353] do_syscall_64+0x166/0x520 [ 104.652444][ T5353] ? trace_irq_disable+0x3b/0x140 [ 104.654570][ T5353] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.657141][ T5353] ? clear_bhb_loop+0x70/0xc0 [ 104.659238][ T5353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.661777][ T5353] RIP: 0033:0x7f0c80d9fb19 [ 104.663680][ T5353] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.671339][ T5353] RSP: 002b:00007f0c81d4afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 104.674808][ T5353] RAX: ffffffffffffffda RBX: 00007f0c81025fa0 RCX: 00007f0c80d9fb19 [ 104.677914][ T5353] RDX: 0000200000000fc0 RSI: 00000000c03064ca RDI: 0000000000000003 [ 104.681107][ T5353] RBP: 00007f0c80e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 104.684328][ T5353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.687593][ T5353] R13: 00007f0c81026038 R14: 00007f0c81025fa0 R15: 00007ffed9fa3458 [ 104.690965][ T5353] [ 104.692628][ T5353] Kernel Offset: disabled [ 104.694382][ T5353] Rebooting in 86400 seconds..